release.yml

name: Release
on:
  push:
    tags:
      - v*
  workflow_dispatch:
    inputs: {}
env:
  CIBW_BUILD: "cp310-* cp311-* cp312-* cp313-*"
jobs:

  Build-Linux:
    strategy:
      matrix:
        include:
          - runner: ubuntu-latest
            cibw_arch: aarch64
          - runner: ubuntu-latest
            cibw_arch: x86_64
    runs-on: ${{ matrix.runner }}
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - name: Set up QEMU
        uses: docker/setup-qemu-action@53851d14592bedcffcf25ea515637cff71ef929a
        with:
          platforms: arm64
      - name: Build wheels
        uses: pypa/cibuildwheel@ee63bf16da6cddfb925f542f2c7b59ad50e93969
        env:
          CIBW_ENVIRONMENT: PATH=$(pwd)/go/bin:$PATH
          CIBW_BEFORE_ALL: sh ci-setup-golang.sh
          CIBW_SKIP: "*musllinux*"
          CIBW_ARCHS: ${{ matrix.cibw_arch }}
      - name: Upload Artifacts
        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08
        with:
          name: wheels-linux-${{ matrix.cibw_arch }}
          path: ./wheelhouse/*.whl

  Build-Windows:
    runs-on: windows-latest
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - name: Set up Go
        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34
        with:
          go-version: "1.21.5"
          cache: true
          cache-dependency-path: "gotfparse/go.sum"
      - name: Build wheels
        uses: pypa/cibuildwheel@ee63bf16da6cddfb925f542f2c7b59ad50e93969
        env:
          CGO_ENABLED: 1
          CIBW_ARCHS: AMD64
      - name: Upload Artifacts
        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08
        with:
          name: wheels-windows
          path: ./wheelhouse/*.whl

  Build-MacOS:
    strategy:
      matrix:
        include:
          - cibw_arch: "x86_64"
            go_arch: "amd64"
          - cibw_arch: "arm64"
            go_arch: "arm64"
    runs-on: macos-latest
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - name: Set up Go
        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34
        with:
          go-version: "1.21.5"
          cache: true
          cache-dependency-path: "gotfparse/go.sum"
      - name: Build wheels
        uses: pypa/cibuildwheel@ee63bf16da6cddfb925f542f2c7b59ad50e93969
        env:
          CGO_ENABLED: 1
          CIBW_ARCHS: ${{ matrix.cibw_arch }}
          GOARCH: ${{ matrix.go_arch }}
      - name: Upload Artifacts
        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08
        with:
          name: wheels-macos-${{ matrix.cibw_arch }}
          path: ./wheelhouse/*.whl

  Gather:
    needs: [Build-Linux, Build-MacOS, Build-Windows]
    runs-on: ubuntu-latest
    outputs:
      hash: ${{ steps.hash.outputs.hash }}
    steps:
      - name: Fetch Wheels
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16
        with:
          pattern: "wheels-*"
          path: dist
          merge-multiple: true
      - name: Display downloaded artifacts
        run: ls -lh dist
      - name: Generate Hashes
        id: hash
        run: cd dist && echo "hash=$(sha256sum * | base64 -w0)" >> $GITHUB_OUTPUT

  Provenance:
    needs: [Gather]
    permissions:
      actions: read
      id-token: write
      contents: write
    # Can't pin with hash due to how this workflow works.
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
    with:
      base64-subjects: ${{ needs.Gather.outputs.hash }}

  Release:
    runs-on: ubuntu-latest
    needs: [Provenance]
    permissions:
      contents: write
    if: startsWith(github.ref, 'refs/tags/')
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - name: Fetch Wheels
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16
        with:
          pattern: "*"
          path: dist
          merge-multiple: true
      - name: Create Release
        uses: ncipollo/release-action@v1
        with:
          artifacts: "dist/*"
          token: ${{ github.token }}
          draft: false
          generateReleaseNotes: true

  Upload:
    needs: [Release]
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    permissions:
      id-token: write
    steps:
      - name: Fetch Wheels
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16
        with:
          pattern: "wheels-*"
          path: dist
          merge-multiple: true
      - name: Upload to PYPI
        uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc